aa8e0839245ecbefed51fea1286d9c40N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

aa8e0839245ecbefed51fea1286d9c40N.exe
Size

610KB
MD5

aa8e0839245ecbefed51fea1286d9c40
SHA1

71ab9a9325ccb849b0c6157d6d387eafdbb5b2f1
SHA256

62e7f8d13b515bcb5687670584d5ec1c2472038b2abc7bd07ec4d82b555ef2c8
SHA512

da33e18ca8465f987146597cbdb8d49a4e5ea486dfccebe126bc5649da4a72390f1ccaac16fc241825e26a9d8df1c48c6cf681dcbec606416da449446e780428
SSDEEP

12288:kzkKcSwogjhmZLbTno7rCYx9wh9wqRdPOhRYcRcnzJWTsaQ:YkKqondHo7+Yx9MdRdPOhOWZI

Score

1^/10

Malware Config

Signatures

Files

aa8e0839245ecbefed51fea1286d9c40N.exe
.dll windows:5 windows x86 arch:x86

4ebcb9c2640115a775bcc06633b2d1b9

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/07/2021, 00:00

Not After

11/07/2024, 23:59

Subject

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/07/2021, 00:00

Not After

11/07/2024, 23:59

Subject

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:5c:bc:35:16:36:68:75:ed:e9:ff:8d:0a:2e:81:47:00:38:06:0b:39:60:9e:e6:a8:9a:92:c7:3c:7a:b0:37
Signer

Actual PE Digest

fd:5c:bc:35:16:36:68:75:ed:e9:ff:8d:0a:2e:81:47:00:38:06:0b:39:60:9e:e6:a8:9a:92:c7:3c:7a:b0:37

Digest Algorithm

sha256

PE Digest Matches

true

e6:f8:7b:e0:9c:8c:b6:be:cc:9d:bb:63:cc:ed:35:e7:54:cd:b0:9b
Signer

Actual PE Digest

e6:f8:7b:e0:9c:8c:b6:be:cc:9d:bb:63:cc:ed:35:e7:54:cd:b0:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

U:\Users\APC\Documents\Visual Studio 2008\Projects\SoftwareLog\Debug\SoftwareLog.pdb

Imports

libcurl

curl_easy_perform
curl_easy_init
curl_slist_append
curl_easy_setopt
curl_easy_getinfo
curl_easy_cleanup

kernel32

FindClose
FindNextFileA
RemoveDirectoryA
DeleteFileA
FindFirstFileA
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateThread
Sleep
GetTickCount
WideCharToMultiByte
GetComputerNameW
GetVersionExW
GetLocalTime
GetProcAddress
GetModuleHandleW
lstrlenA
GetVolumeInformationA
GetSystemDirectoryA
WriteConsoleA
GetUserDefaultLCID
GetConsoleOutputCP
SetEndOfFile
ReadFile
GetTimeZoneInformation
CompareStringA
CompareStringW
EnumSystemLocalesA
IsValidLocale
GetDateFormatA
GetTimeFormatA
LCMapStringW
LCMapStringA
GetStringTypeW
GetSystemInfo
GetCommandLineA
GetStringTypeA
GetLocaleInfoA
GetLocaleInfoW
FreeLibrary
VirtualQuery
GetProcessHeap
CreateFileA
SetFilePointer
InitializeCriticalSectionAndSpinCount
SetStdHandle
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
DeleteCriticalSection
RtlUnwind
GetLastError
CreateDirectoryA
GetFileAttributesA
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetCurrentThreadId
SetEnvironmentVariableA
HeapValidate
IsBadReadPtr
CloseHandle
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
DebugBreak
MultiByteToWideChar
LoadLibraryA
FatalAppExitA
ExitProcess
WriteFile
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode

user32

GetSystemMetrics

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

ole32

CoCreateGuid

ws2_32

inet_ntoa
WSACleanup
gethostbyname
WSAStartup

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState
InternetOpenA
InternetSetOptionW
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoW
InternetReadFile

winmm

timeGetTime

Exports

Exports

CreateExportObj
DestroyExportObj
NSISLog

Sections

.textbss
Size: - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 471KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ebcb9c2640115a775bcc06633b2d1b9

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

fd:5c:bc:35:16:36:68:75:ed:e9:ff:8d:0a:2e:81:47:00:38:06:0b:39:60:9e:e6:a8:9a:92:c7:3c:7a:b0:37Signer

e6:f8:7b:e0:9c:8c:b6:be:cc:9d:bb:63:cc:ed:35:e7:54:cd:b0:9bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcurl

kernel32

user32

advapi32

ole32

ws2_32

iphlpapi

wininet

winmm

Exports

Exports

Sections

.textbss Size: - Virtual size: 221KB

.text Size: 471KB - Virtual size: 470KB

.rdata Size: 86KB - Virtual size: 86KB

.data Size: 6KB - Virtual size: 15KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 21KB - Virtual size: 20KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

fd:5c:bc:35:16:36:68:75:ed:e9:ff:8d:0a:2e:81:47:00:38:06:0b:39:60:9e:e6:a8:9a:92:c7:3c:7a:b0:37
Signer

e6:f8:7b:e0:9c:8c:b6:be:cc:9d:bb:63:cc:ed:35:e7:54:cd:b0:9b
Signer

.textbss
Size: - Virtual size: 221KB

.text
Size: 471KB - Virtual size: 470KB

.rdata
Size: 86KB - Virtual size: 86KB

.data
Size: 6KB - Virtual size: 15KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 21KB - Virtual size: 20KB